Privacy policy_

What we store

• Your account: email, username, an optional bio and name, whether your email is confirmed, and your password as a one-way hash (we can't read it).
• Google or Apple sign-in, if you use it: the account ID and basic profile details they send, like your email and name. We don't keep their access tokens.
• Listings and uploads: what you write about a product, the zip you upload (stored privately, never at a public address), the results of the upload checks, short fingerprints of your code for the copy check (hashes, not the code), and notes from the automated reviewers.
• Orders: what was bought, when, the amounts, the order status, and the IDs Stripe gives the payment, refund and transfers.
• Sellers' payouts: your Stripe account ID and whether it's ready to be paid, and each cut you're owed.
• Card details go straight to Stripe. We never see or store your card number.

Security and logs

• To stop password guessing and spam, we count wrong logins, sign-ups and reset emails per IP address in short-lived counters. They expire within an hour or so.
• Our hosting provider keeps server logs with IP addresses and the pages requested, for running and securing the site.

Cookies

Only what the site needs: a session cookie that keeps you logged in, a security cookie (CSRF) that protects forms, and a short-lived cookie for one-time notices like "You're logged out." No advertising or tracking cookies, and no analytics.

Fonts load from Google Fonts, so Google sees your IP address when a page loads.

Who else sees it

• Stripe handles payments, refunds and sellers' payouts, under its own privacy policy.
• Our email provider sends account emails (confirmations, password resets, review results).
• Our hosting provider runs the servers and the database.
• Google or Apple, if you sign in with them.
• Automated reviewers: listings waiting for review (the listing text and the code, with secrets the scan finds removed) are sent, either from our servers or through our own review tools, to AI services from Anthropic (Claude) and OpenAI (ChatGPT) for review. Buyers, emails, prices and earnings are never sent.
• VirusTotal, if the virus scan uses it: only SHA-256 hashes of uploaded files, never the files.
• OSV.dev (Google's open vulnerability database), for the dependency audit: only the names and exact versions of the packages your upload's dependency files list (like requests 2.34.2), never your files, your code or anything about you.
• Anyone the law requires us to share with, or to protect people from fraud or harm.

We don't sell your data.

What's public

Your @handle, bio, live listings and their descriptions, and the credits in family trees. Your email, purchases, sales and earnings are never public.

How long we keep it

• Account details: while your account is open.
• Orders and payout records: as long as tax and accounting rules need, even after an account closes.
• Uploads that fail the checks: deleted right away. The check results stay with the listing.
• Security counters: an hour or less. Review-line activity for staff: 30 days.

Your choices

Write to us to get a copy of your data, correct it, or close your account and delete what we don't have to keep. We answer within 30 days.

How we protect it

Passwords are hashed, the site only works over https, uploads are kept privately, and the admin needs two-step login. No system is perfect, so tell us right away if you think your account was misused.

CodeHeirs is for adults. We don't knowingly collect data from children.

Changes

We may update this policy. The date at the top shows the latest version. If a change matters, we'll tell account holders by email or on the site first.

Contact

Christopher Theus runs CodeHeirs. Questions, reports and requests about these pages go to hello@codeheirs.com.